chore(deps): update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/checkout	action	patch	v6.0.1 → v6.0.2
actions/setup-go	action	minor	v6.1.0 → v6.2.0	v6.3.0
actions/setup-node	action	minor	v6.1.0 → v6.2.0
actions/setup-python	action	minor	v6.1.0 → v6.2.0
actions/stale	action	minor	v10.1.1 → v10.2.0
codecov/codecov-action	action	patch	v5.5.1 → v5.5.2
docker/build-push-action	action	minor	v6.18.0 → v6.19.2
docker/login-action	action	minor	v3.6.0 → v3.7.0
docker/setup-buildx-action	action	minor	v3.11.1 → v3.12.0
fossas/fossa-action	action	minor	v1.7.0 → v1.8.0
github/codeql-action	action	minor	v4.31.7 → v4.32.3	v4.32.5 (+1)

---

Release Notes

actions/checkout (actions/checkout)

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

actions/setup-go (actions/setup-go)

v6.2.0

Compare Source

What's Changed

Enhancements

• Example for restore-only cache in documentation by @​aparnajyothi-y in #​696
• Update Node.js version in action.yml by @​ccoVeille in #​691
• Documentation update of actions/checkout by @​deining in #​683

Dependency updates

• Upgrade js-yaml from 3.14.1 to 3.14.2 by @​dependabot in #​682
• Upgrade @​actions/cache to v5 by @​salmanmkc in #​695
• Upgrade actions/checkout from 5 to 6 by @​dependabot in #​686
• Upgrade qs from 6.14.0 to 6.14.1 by @​dependabot in #​703

New Contributors

• @​ccoVeille made their first contribution in #​691
• @​deining made their first contribution in #​683

Full Changelog: actions/setup-go@v6...v6.2.0

actions/setup-node (actions/setup-node)

v6.2.0

Compare Source

actions/setup-python (actions/setup-python)

v6.2.0

Compare Source

actions/stale (actions/stale)

v10.2.0

Compare Source

codecov/codecov-action (codecov/codecov-action)

v5.5.2

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2

docker/build-push-action (docker/build-push-action)

v6.19.2

Compare Source

• Preserve port in GIT_AUTH_TOKEN host by @​crazy-max in #​1458

Full Changelog: docker/build-push-action@v6.19.1...v6.19.2

v6.19.1

Compare Source

• Derive GIT_AUTH_TOKEN host from GitHub server URL by @​crazy-max in #​1456

Full Changelog: docker/build-push-action@v6.19.0...v6.19.1

v6.19.0

Compare Source

• Scope default git auth token to github.com by @​crazy-max in #​1451
• Bump brace-expansion from 1.1.11 to 1.1.12 in #​1396
• Bump form-data from 2.5.1 to 2.5.5 in #​1391
• Bump js-yaml from 3.14.1 to 3.14.2 in #​1429
• Bump lodash from 4.17.21 to 4.17.23 in #​1446
• Bump tmp from 0.2.3 to 0.2.4 in #​1398
• Bump undici from 5.28.4 to 5.29.0 in #​1397

Full Changelog: docker/build-push-action@v6.18.0...v6.19.0

docker/login-action (docker/login-action)

v3.7.0

Compare Source

• Add scope input to set scopes for the authentication token by @​crazy-max in #​912
• Add support for AWS European Sovereign Cloud ECR by @​dphi in #​914
• Ensure passwords are redacted with registry-auth input by @​crazy-max in #​911
• build(deps): bump lodash from 4.17.21 to 4.17.23 in #​915

Full Changelog: docker/login-action@v3.6.0...v3.7.0

docker/setup-buildx-action (docker/setup-buildx-action)

v3.12.0

Compare Source

• Deprecate install input by @​crazy-max in #​455
• Bump @​docker/actions-toolkit from 0.62.1 to 0.63.0 in #​434
• Bump brace-expansion from 1.1.11 to 1.1.12 in #​436
• Bump form-data from 2.5.1 to 2.5.5 in #​432
• Bump undici from 5.28.4 to 5.29.0 in #​435

Full Changelog: docker/setup-buildx-action@v3.11.1...v3.12.0

fossas/fossa-action (fossas/fossa-action)

v1.8.0

Compare Source

github/codeql-action (github/codeql-action)

v4.32.3

Compare Source

• Added experimental support for testing connections to private package registries. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. #​3466

v4.32.2

Compare Source

v4.32.1

Compare Source

• A warning is now shown in Default Setup workflow logs if a private package registry is configured using a GitHub Personal Access Token (PAT), but no username is configured. #​3422
• Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. #​3421

v4.32.0

Compare Source

• Update default CodeQL bundle version to 2.24.0. #​3425

v4.31.11

Compare Source

• When running a Default Setup workflow with Actions debugging enabled, the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. #​3409
• Improved error handling throughout the CodeQL Action. #​3415
• Added experimental support for automatically excluding generated files from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. #​3318
• The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. #​3403

v4.31.10

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.10 - 12 Jan 2026

• Update default CodeQL bundle version to 2.23.9. #​3393

See the full CHANGELOG.md for more information.

v4.31.9

Compare Source

v4.31.8

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

4.31.8 - 11 Dec 2025

• Update default CodeQL bundle version to 2.23.8. #​3354

See the full CHANGELOG.md for more information.

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month ( * 0-3 1 * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.87%. Comparing base (0e03a9c) to head (57f7d4b).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1851      +/-   ##
==========================================
+ Coverage   77.50%   78.87%   +1.36%     
==========================================
  Files          19       19              
  Lines        1209     1188      -21     
==========================================
  Hits          937      937              
+ Misses        176      155      -21     
  Partials       96       96              

see 4 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.